U.S. Commerce Dept Imposes Export Controls on Anthropic’s Claude Mythos 5 and Fable 5

Key Takeaways

• The U.S. Commerce Department has imposed stringent export controls on Anthropic’s new AI models, Claude Mythos 5 and Fable 5.
• Anthropic must now secure an individual export license for sharing these models with any foreign national globally, including non-U.S. employees.
• The directive, issued shortly after the models’ launch, stems from concerns about a reported jailbreak vulnerability in Fable 5 that could expose Mythos 5’s advanced cybersecurity capabilities.
• This marks the first time the Commerce Department has utilized specific provisions of the Export Control Reform Act against a commercially available AI model, setting a significant precedent.

In an unprecedented move, the U.S. Bureau of Industry and Security (BIS) has issued a directive to Anthropic, mandating strict export controls on its recently launched artificial intelligence models, Claude Mythos 5 and Claude Fable 5. This “Is Informed” letter, addressed to Anthropic CEO Dario Amodei, requires the company to obtain an individually validated export license before making these advanced AI models accessible to any foreign national, regardless of their location worldwide.

The directive, signed by Commerce Secretary Howard W. Lutnick, leverages the Export Control Reform Act of 2018 (ECRA), specifically 50 U.S.C. § 4817(b)(1). This section grants the agency authority to implement interim controls on emerging and foundational technologies deemed critical to U.S. national security. Furthermore, the order invokes § 744.22(b) of the Export Administration Regulations (EAR), 15 C.F.R. Parts 730–774, which permits BIS to demand export licenses when there’s an unacceptable risk of technology being used in or diverted to “military-intelligence end use” or by a “military-intelligence end user.” This application of ECRA provisions to a commercially available AI model is a first for the Commerce Department.

Global Restrictions on Claude Mythos 5 and Fable 5

The BIS directive encompasses a wide range of activities related to the Claude Mythos 5 and Fable 5 models, including any export, reexport, or in-country transfer, as well as deemed exports and deemed reexports. This comprehensive scope extends to:

• Physical or electronic transfer of the model out of the United States (§ 734.13(a)(1) of the EAR).
• Movement of the model from one foreign nation to another (§ 734.14(a)(1) of the EAR).
• Internal retransfer of the model within a single foreign country (§ 734.16 of the EAR).
• Disclosure of the model to a “foreign person” within U.S. borders, which includes non-citizen employees of Anthropic.

Anthropic received this directive on June 12, 2026, at 5:21 PM ET, just three days after the models’ launch on June 9. The company promptly responded by disabling global access to both models.

Catalyst for the Controls

The primary driver behind this rapid and decisive action appears to be a reported jailbreak vulnerability identified in Fable 5. This flaw allegedly allows users to bypass the model’s integrated safety filters, potentially exposing the advanced cybersecurity capabilities inherent in the underlying Mythos 5 framework. Mythos 5 is particularly adept at pinpointing software vulnerabilities, including deeply embedded flaws in production codebases, and was initially designed for exclusive deployment by government entities and select enterprise partners. Anthropic, however, maintains that the identified bypass only reveals “minor” security flaws that are also discoverable by other publicly available frontier AI models.

In response to the restrictions, over 80 cybersecurity executives and experts, including leaders from Nvidia and Adobe, have signed an open letter to Secretary Lutnick. They advocate for lifting the controls, supporting Anthropic’s assertion that the perceived threat is overstated.

Compliance and Broader Implications

To resume operations involving these models, Anthropic must now submit license applications through the Simplified Network Application Process Redesign (SNAP-R) portal (snapr.bis.gov), explicitly referencing the “Is Informed” letter in the Additional Information field. Non-compliance with this directive carries severe criminal and civil penalties under U.S. law.

The implications of this action are already rippling internationally. The EU Commission has voiced concerns, stating that such controls “should not be discriminatory,” hinting at potential diplomatic tensions. Domestically, the restrictions also impact foreign nationals working on H-1B visas at U.S. AI firms, raising significant questions about workforce accessibility and enterprise operations. The BIS letter clarifies that these license requirements will remain in effect until a subsequent letter from BIS revises or rescinds the order. This development establishes a crucial precedent for how the U.S. government intends to regulate advanced AI as a dual-use technology under export control law moving forward.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.